From 756653ae999cfd0d248daaae185bb360aa8a0d45 Mon Sep 17 00:00:00 2001 From: Gerald Pinder Date: Tue, 9 Sep 2025 21:05:02 -0400 Subject: [PATCH] Implement kernel signing --- .gitignore | 1 + .gitlab-ci.yml | 11 ++-- .../pki/akmods/certs/akmods-wunker-bunker.der | Bin 0 -> 1039 bytes files/scripts/installnvidiakmod.sh | 58 ++++++++++++++++++ files/scripts/installnvidiapackages.sh | 51 +++++++++++++++ files/scripts/signkernel.sh | 3 +- files/scripts/signmodules.sh | 5 +- justfile | 7 +++ openssl.cnf | 23 +++++++ recipes/base-cosmic-nvidia.yml | 4 +- recipes/base-cosmic.yml | 3 +- recipes/base-kinoite-nvidia.yml | 4 +- recipes/base-kinoite.yml | 3 +- recipes/base/common.yml | 25 ++++---- recipes/base/nvidia.yml | 23 ++++--- recipes/base/post-build.yml | 18 ++++++ 16 files changed, 200 insertions(+), 39 deletions(-) create mode 100644 files/base/etc/pki/akmods/certs/akmods-wunker-bunker.der create mode 100644 files/scripts/installnvidiakmod.sh create mode 100644 files/scripts/installnvidiapackages.sh create mode 100644 openssl.cnf create mode 100644 recipes/base/post-build.yml diff --git a/.gitignore b/.gitignore index 11ad37c..c5c9f20 100644 --- a/.gitignore +++ b/.gitignore @@ -1,5 +1,6 @@ .idea cosign.key +.secure-files/ /Containerfile /.env /Containerfile.* diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index 70c80de..ec6fd5f 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -41,14 +41,13 @@ base-images: parallel: matrix: - RECIPE: - - base-kinoite.yml - - base-cosmic.yml - - base-kinoite-nvidia.yml + # - base-cosmic.yml - base-cosmic-nvidia.yml + # - base-kinoite.yml + # - base-kinoite-nvidia.yml # TAG: 519-device-or-resource-busy-when-trying-to-rechunk-the-image-in-gitlab-ci - # BB_BUILD_PUSH: 'true' - BB_CACHE_LAYERS: 'true' - # BB_BUILD_RECHUNK: 'true' + BB_BUILD_PUSH: 'true' + BB_BUILD_RECHUNK: 'true' build-image: extends: diff --git a/files/base/etc/pki/akmods/certs/akmods-wunker-bunker.der b/files/base/etc/pki/akmods/certs/akmods-wunker-bunker.der new file mode 100644 index 0000000000000000000000000000000000000000..35fb78056c62f0fd350e21a42a755a0a82a36a3f GIT binary patch literal 1039 zcmXqLV&OJuV*0#*nTe5!NkqoU)n(l&dkFb4i->w zf`}^`$iofiWE2xh&n?KzOGzzqNY72o%+X8E&oxjG=QT1lurxFU~XdMXE11Dba2+QOvz;tFJ(>(aLuv3y+g}kv1Aj2TH6PywH4RbM+E$S z`=V0vO!}#nn^&CQn2?)gW@2*pfzZj1J)N1Ci*#9aqZ@5L*=*5&R5n38YF)zV&V60B z!4ofQM6NCrn#OSEne6ZWr)$}AxSON3emmb_p1Eq%YO|xWf4a8xm@hgqr!{f;;(NR9 z+{~O?p6DXP<92P{!oCwP_C2&?6#ZO({hM8Ull85aESVxzPaPI4s#Gxjma%Hu5{@)K zFV(CNlM5AxW|*9cJ%6m>$(>K3QMrwa5^t@lSbD9{MPaRs@%qDW9hsOJ85kEgE-+}E zYak0u4YGVJVk{!p?|6H}hy9uBcW2V3Q@^rj{!Vyy1sM52X=N4(1F;6|3V1*Ygc%wC zvoIMjK$NS3l(TVYvoW%=vNJQYaRFH@j7{cT%xnfaY@7*g9*k{2oEUjoYm5RJslA~YZIOQr`P)ypAD*Ej$hMr;!dUS z!LNz+(qx@zb8yWZJWi!V>;pAvXU zR!(*z>#gfk=6ZaK{XS`Co1Ta?_qmG_CJ$`NPJO64aXJ2F(ci>Ho3H73S*=rj!fP9x zdi&>doz%XsJsu}Kg|}n|YR9(TGrZT>7rA|nt /dev/null || \ + (cat "/var/cache/akmods/nvidia/*.failed.log" && exit 1) + +# View license information +# Depends on word splitting +# shellcheck disable=SC2086 +modinfo -l /usr/lib/modules/${KERNEL_VERSION}/extra/nvidia/nvidia{,-drm,-modeset,-peermem,-uvm}.ko.xz + +./signmodules.sh "nvidia" + +rm -f /etc/yum.repos.d/negativo17-fedora-nvidia.repo + +systemctl disable akmods-keygen@akmods-keygen.service +systemctl mask akmods-keygen@akmods-keygen.service +systemctl disable akmods-keygen.target +systemctl mask akmods-keygen.target diff --git a/files/scripts/installnvidiapackages.sh b/files/scripts/installnvidiapackages.sh new file mode 100644 index 0000000..edc3780 --- /dev/null +++ b/files/scripts/installnvidiapackages.sh @@ -0,0 +1,51 @@ +#!/usr/bin/env bash + +# Copyright 2025 The Secureblue Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software distributed under the License is +# distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and limitations under the License. + +set -oue pipefail + +nvidia_packages_list=('nvidia-container-toolkit' 'nvidia-driver-cuda') +if [[ "$IMAGE_NAME" != *"securecore"* ]]; then + nvidia_packages_list+=('libnvidia-fbc' 'libva-nvidia-driver' 'nvidia-driver' 'nvidia-modprobe' 'nvidia-persistenced' 'nvidia-settings') +fi + +curl -L https://nvidia.github.io/libnvidia-container/stable/rpm/nvidia-container-toolkit.repo \ + -o /etc/yum.repos.d/nvidia-container-toolkit.repo +sed -i 's/^gpgcheck=0/gpgcheck=1/' /etc/yum.repos.d/nvidia-container-toolkit.repo + +curl -L https://negativo17.org/repos/fedora-nvidia.repo -o /etc/yum.repos.d/negativo17-fedora-nvidia.repo + + +sed -i 's/^enabled=0.*/enabled=1/' /etc/yum.repos.d/nvidia-container-toolkit.repo +sed -i 's/^enabled=0.*/enabled=1\npriority=90/' /etc/yum.repos.d/negativo17-fedora-nvidia.repo +# required for rpm-ostree to function properly +# shellcheck disable=SC2068 +rpm-ostree install ${nvidia_packages_list[@]} + +kmod_version=$(rpm -qa | grep akmod-nvidia | awk -F':' '{print $(NF)}' | awk -F'-' '{print $(NF-1)}') +negativo_version=$(rpm -qa | grep nvidia-modprobe | awk -F':' '{print $(NF)}' | awk -F'-' '{print $(NF-1)}') + +echo "kmod_version: ${kmod_version}" +echo "negativo_version: ${negativo_version}" +if [[ "$kmod_version" != "$negativo_version" ]]; then + echo "Version mismatch!" + exit 1 +fi + +curl -L https://raw.githubusercontent.com/NVIDIA/dgx-selinux/master/bin/RHEL9/nvidia-container.pp \ + -o nvidia-container.pp +semodule -i nvidia-container.pp + +rm -f nvidia-container.pp +rm -f /etc/yum.repos.d/negativo17-fedora-nvidia.repo +rm -f /etc/yum.repos.d/nvidia-container-toolkit.repo diff --git a/files/scripts/signkernel.sh b/files/scripts/signkernel.sh index 9fd8ad2..f8c1bc8 100644 --- a/files/scripts/signkernel.sh +++ b/files/scripts/signkernel.sh @@ -17,8 +17,7 @@ set -oue pipefail KERNEL_VERSION="$(rpm -q "kernel" --queryformat '%{VERSION}-%{RELEASE}.%{ARCH}')" -PUBLIC_KEY_DER_PATH="../system/etc/pki/akmods/certs/akmods-secureblue.der" -PUBLIC_KEY_CRT_PATH="./certs/public_key.crt" +PUBLIC_KEY_CRT_PATH="/tmp/certs/public_key.crt" PRIVATE_KEY_PATH="/tmp/certs/private_key.priv" openssl x509 -in "$PUBLIC_KEY_DER_PATH" -out "$PUBLIC_KEY_CRT_PATH" diff --git a/files/scripts/signmodules.sh b/files/scripts/signmodules.sh index 38639e1..fbbc025 100644 --- a/files/scripts/signmodules.sh +++ b/files/scripts/signmodules.sh @@ -23,13 +23,12 @@ fi KERNEL_VERSION="$(rpm -q "kernel" --queryformat '%{VERSION}-%{RELEASE}.%{ARCH}')" -PUBLIC_KEY_DER_PATH="../system/etc/pki/akmods/certs/akmods-secureblue.der" -PUBLIC_KEY_CRT_PATH="./certs/public_key.crt" +PUBLIC_KEY_CRT_PATH="/tmp/certs/public_key.crt" PRIVATE_KEY_PATH="/tmp/certs/private_key.priv" openssl x509 -in "$PUBLIC_KEY_DER_PATH" -out "$PUBLIC_KEY_CRT_PATH" PRIVATE_KEY_PATH="/tmp/certs/private_key.priv" -SIGNING_KEY="./certs/signing_key.pem" +SIGNING_KEY="/tmp/certs/signing_key.pem" cat "$PRIVATE_KEY_PATH" <(echo) "$PUBLIC_KEY_CRT_PATH" >> "$SIGNING_KEY" for module in /usr/lib/modules/"${KERNEL_VERSION}"/extra/"${MODULE_NAME}"/*.ko*; do diff --git a/justfile b/justfile index c0f3103..32fcc63 100644 --- a/justfile +++ b/justfile @@ -46,3 +46,10 @@ toggle-nvk: echo "Rebasing to ${NEW_IMAGE}" rpm-ostree rebase ${CURRENT_URI}${NEW_IMAGE} just _configure-nvidia ${CONFIG_ACTION} + +generate-secureboot-key: + openssl req -config ./openssl.cnf \ + -new -x509 -newkey rsa:2048 \ + -nodes -days 36500 -outform DER \ + -keyout ./.secure-files/MOK.priv \ + -out ./files/base/etc/pki/akmods/certs/akmods-wunker-bunker.der diff --git a/openssl.cnf b/openssl.cnf new file mode 100644 index 0000000..1e5a569 --- /dev/null +++ b/openssl.cnf @@ -0,0 +1,23 @@ +# This definition stops the following lines choking if HOME isn't +# defined. +HOME = . +RANDFILE = $ENV::HOME/.rnd +[ req ] +distinguished_name = req_distinguished_name +x509_extensions = v3 +string_mask = utf8only +prompt = no + +[ req_distinguished_name ] +countryName = US +stateOrProvinceName = NC +0.organizationName = wunker-bunker +commonName = Wunker Bunker +emailAddress = gmpinder@gmail.com + +[ v3 ] +subjectKeyIdentifier = hash +authorityKeyIdentifier = keyid:always,issuer +basicConstraints = critical,CA:FALSE +extendedKeyUsage = codeSigning,1.3.6.1.4.1.311.10.3.6 +nsComment = "OpenSSL Generated Certificate" diff --git a/recipes/base-cosmic-nvidia.yml b/recipes/base-cosmic-nvidia.yml index 85e5ec6..da778b1 100644 --- a/recipes/base-cosmic-nvidia.yml +++ b/recipes/base-cosmic-nvidia.yml @@ -5,5 +5,7 @@ base-image: quay.io/fedora/fedora-bootc image-version: 42 description: The base image of Wunker OS modules: - - from-file: base/nvidia.yml - from-file: base/common.yml + - from-file: base/cosmic.yml + - from-file: base/nvidia.yml + - from-file: base/post-build.yml diff --git a/recipes/base-cosmic.yml b/recipes/base-cosmic.yml index e55b58c..0ba4fcd 100644 --- a/recipes/base-cosmic.yml +++ b/recipes/base-cosmic.yml @@ -5,5 +5,6 @@ base-image: quay.io/fedora/fedora-bootc image-version: 42 description: The base image of Wunker OS modules: - - from-file: base/cosmic.yml - from-file: base/common.yml + - from-file: base/cosmic.yml + - from-file: base/post-build.yml diff --git a/recipes/base-kinoite-nvidia.yml b/recipes/base-kinoite-nvidia.yml index 09c3bb0..4f31962 100644 --- a/recipes/base-kinoite-nvidia.yml +++ b/recipes/base-kinoite-nvidia.yml @@ -5,7 +5,7 @@ base-image: quay.io/fedora/fedora-bootc image-version: 42 description: The base image of Wunker OS modules: + - from-file: base/common.yml - from-file: base/kinoite.yml - from-file: base/nvidia.yml - - from-file: base/common.yml - + - from-file: base/post-build.yml diff --git a/recipes/base-kinoite.yml b/recipes/base-kinoite.yml index 9124a04..0a84e7e 100644 --- a/recipes/base-kinoite.yml +++ b/recipes/base-kinoite.yml @@ -5,5 +5,6 @@ base-image: quay.io/fedora/fedora-bootc image-version: 42 description: The base image of Wunker OS modules: - - from-file: base/kinoite.yml - from-file: base/common.yml + - from-file: base/kinoite.yml + - from-file: base/post-build.yml diff --git a/recipes/base/common.yml b/recipes/base/common.yml index 862d92e..a2313fa 100644 --- a/recipes/base/common.yml +++ b/recipes/base/common.yml @@ -1,4 +1,12 @@ +--- +# yaml-language-server: $schema=https://schema.blue-build.org/module-list-v1.json modules: + - type: files + files: + - source: bootc-update + destination: /usr/lib/systemd/system + - source: base + destination: / - type: script env: CSFG: /usr/lib/systemd/system-generators/coreos-sulogin-force-generator @@ -8,22 +16,13 @@ modules: # see detail: https://github.com/ublue-os/main/issues/653 - curl -sSLo ${CSFG} https://raw.githubusercontent.com/coreos/fedora-coreos-config/refs/heads/stable/overlay.d/05core/usr/lib/systemd/system-generators/coreos-sulogin-force-generator - chmod +x ${CSFG} - - type: files - files: - - source: bootc-update - destination: /usr/lib/systemd/system + - type: dnf + install: + packages: + - sbsign - type: systemd system: masked: - rpm-ostreed-automatic.timer enabled: - bootc-fetch-apply-updates.timer - - type: copy - src: files/base/usr/share/plymouth - dest: /usr/share/plymouth - # - type: os-release - # properties: - # NAME: WunkerOS - # ID: wunker_os - # PRETTY_NAME: Wunker OS - - from-file: common/post-build.yml diff --git a/recipes/base/nvidia.yml b/recipes/base/nvidia.yml index a76c1c9..bbe0412 100644 --- a/recipes/base/nvidia.yml +++ b/recipes/base/nvidia.yml @@ -1,17 +1,20 @@ --- # yaml-language-server: $schema=https://schema.blue-build.org/module-list-v1.json modules: - - type: dnf - repos: - cleanup: true - nonfree: rpmfusion - install: - packages: - - akmod-nvidia - type: script - snippets: - - echo "%_with_kmod_nvidia_open 1" > /etc/rpm/macros.nvidia-kmod - - akmods --kernels "$(rpm -q "kernel" --queryformat '%{VERSION}-%{RELEASE}.%{ARCH}')" --rebuild + env: + PUBLIC_KEY_DER_PATH: /etc/pki/akmods/certs/akmods-wunker-bunker.der + secrets: + - type: file + source: ./.secure-files/MOK.priv + mount: + type: file + destination: /tmp/certs/private_key.priv + scripts: + - installnvidiakmod.sh + - type: script + scripts: + - installnvidiapackages.sh - type: files files: - source: nvidia-kargs diff --git a/recipes/base/post-build.yml b/recipes/base/post-build.yml new file mode 100644 index 0000000..45f6148 --- /dev/null +++ b/recipes/base/post-build.yml @@ -0,0 +1,18 @@ +--- +# yaml-language-server: $schema=https://schema.blue-build.org/module-list-v1.json +modules: + - type: script + env: + PUBLIC_KEY_DER_PATH: /etc/pki/akmods/certs/akmods-wunker-bunker.der + secrets: + - type: file + source: ./.secure-files/MOK.priv + mount: + type: file + destination: /tmp/certs/private_key.priv + scripts: + - signkernel.sh + - type: initramfs + env: + DRACUT_NO_XATTR: '1' + source: local